CVE-2026-76313: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. in Splunk Splunk Enterprise

In Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the REST API endpoint for uploading knowledge bundles does not enforce the required high-privilege capability edit_dist_peer. Consequently, users without admin or power roles can upload malicious knowledge bundles that distributed search uses, enabling remote code execution. This flaw allows unauthorized actors to access all relevant data and impacts system integrity and availability. The vulnerability arises from improper access control on the knowledge bundle upload and acceptance process in distributed search.

An attacker with limited privileges (not holding admin or power roles) can execute arbitrary code remotely by uploading a malicious knowledge bundle. This can lead to unauthorized access to sensitive data, compromise of system integrity, and disruption of availability. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Fixed versions are available: upgrade to Splunk Enterprise 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later. Applying these official fixes will remediate the vulnerability by enforcing proper capability checks on knowledge bundle uploads. No additional mitigation steps are indicated in the advisory.